v0.8.0 Release
🚀 Major Features
Enhanced Call Graph Construction and Visualization
- Call graph construction and visualization system - comprehensive analysis of function calls and references
- Unified calls and references system - integrated tracking of code relationships
- Tree-sitter query migration - replaced regex patterns with tree-sitter queries for better code analysis
- Pattern-based vulnerability analysis - streamlined detection with improved accuracy
Improved CLI Architecture
- Cobra-style CLI architecture - restructured command-line interface for better user experience
- Graph subcommand - separated call graph generation into dedicated subcommand
- TOML configuration file support - enhanced configuration management
- Debug mode enhancements - improved troubleshooting capabilities
Performance & Scalability Improvements
- Parallel processing capacity increases - significantly faster analysis for large repositories
- Comprehensive timeout handling - improved reliability for enterprise-scale analysis
- Benchmark validation system - extensive testing against real-world vulnerabilities
- Performance benchmark tests - Node.js, Django, and Spring Boot specific optimizations
Extended Language and Framework Support
- PHP language support - comprehensive PHP vulnerability detection
- Terraform support - Infrastructure as Code security analysis
- Custom API base URL support - flexible endpoint configuration
- Multi-architecture Docker builds - improved container deployment
🔧 Improvements
Developer Experience
- Comprehensive test suite - extensive unit and integration tests
- Benchmark feature flag - exclude API tests by default for faster local testing
- Real-world benchmark validation - tested against validation-benchmarks repository
- Improved error handling - better feedback and recovery mechanisms
Analysis Quality
- PAR model classification enhancements - improved Principal-Action-Resource detection
- Enhanced pattern detection - better capture of full definitions and references
- Built-in patterns updates - comprehensive patterns for all supported languages
- Prompt optimizations - refined LLM analysis prompts for better accuracy
Configuration & Customization
- Custom pattern loading - support for vuln-patterns.yml configuration
- Environment variable controls - PARSENTRY_DISABLE_V1_PATH for custom endpoints
- Flexible output processing - organized reports module structure
- API key authentication fixes - resolved custom URL authentication issues
🐛 Bug Fixes
- Fixed compiler warnings by properly handling unused fields
- Resolved Django benchmark test compilation errors
- Fixed edge count inconsistencies in call graph generation
- Improved call graph function call extraction
- Fixed tree-sitter predicate evaluation in pattern matching
- Resolved Rust definition query issues
- Fixed locale support and compilation errors
- Improved principal detection accuracy
📄 Migration Notes
Breaking Changes
- CLI structure has been reorganized to cobra-style architecture
- Graph functionality moved to dedicated subcommand
- Pattern format updated to tree-sitter queries
New Capabilities
- Call graph construction and visualization
- PHP language analysis
- Terraform Infrastructure as Code analysis
- Custom API endpoint configuration
- TOML configuration files
🛠️ Usage Examples
# Generate call graph with visualization
parsentry graph --root /path/to/project --output-dir ./graphs
# Analyze PHP project
parsentry --root /path/to/php/project --output-dir ./reports
# Use custom API endpoint
export PARSENTRY_DISABLE_V1_PATH=true
parsentry --root /path/to/project --api-base-url https://custom.api.com
# Load custom patterns
parsentry --root /path/to/project --patterns ./vuln-patterns.yml
# Run with comprehensive benchmarks
cargo test --features benchmark
🔍 Architecture Improvements
- Modular reports processing - organized output generation
- Pattern-based analysis - improved detection methodology
- Tree-sitter integration - enhanced parsing capabilities
- Unified reference tracking - comprehensive code relationship analysis
📊 Performance Benchmarks
This release includes comprehensive performance benchmarks against:
- Node.js applications
- Django applications
- Spring Boot applications
- Real-world vulnerable applications from validation-benchmarks
🎯 Focus Areas
- Code relationship analysis - enhanced understanding of function calls and references
- Multi-language support - expanded coverage including PHP and Terraform
- Performance optimization - faster analysis for large codebases
- Developer experience - improved CLI and configuration options
This release significantly enhances Parsentry's code analysis capabilities with comprehensive call graph construction, improved language support, and performance optimizations for enterprise-scale security analysis.